Email spoofing and phishing cost billions annually. SPF, DKIM, and DMARC are the three DNS-based standards that, together, form the strongest defense available to domain owners.
| Standard | What It Authenticates | How | DNS Record Type |
|---|---|---|---|
| SPF | Sending server IP authorized? | Allowlist of IPs/ranges in DNS | TXT (_domainname) |
| DKIM | Message content unaltered? | Cryptographic signature in header | TXT (selector._domainkey) |
| DMARC | Both SPF and DKIM align? | Policy enforcement + reporting | TXT (_dmarc) |
SPF allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. The receiving mail server checks whether the sending server's IP address matches the authorized IPs listed in the domain's SPF TXT record.
An SPF record looks like: v=spf1 include:_spf.google.com include:mailgun.org ip4:203.0.113.5 ~all
The mechanisms: include: delegates to another domain's SPF; ip4:/ip6: specifies explicit IPs; a: includes the domain's A record IP; mx: includes MX server IPs. The qualifier at the end (-all = hard fail, ~all = soft fail, ?all = neutral) determines what happens to mail from unlisted sources.
SPF limitation: SPF only checks the envelope "From" (MAIL FROM / Return-Path), not the visible "From" header that users see. Email forwarders break SPF because the forwarding server's IP wasn't in the original sender's SPF record.
DKIM adds a cryptographic signature to outgoing email headers. The sending mail server signs the message with a private key; the receiving server retrieves the corresponding public key from DNS and verifies the signature. This proves the message came from an authorized sender and wasn't altered in transit.
A DKIM signature in email headers: DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=mail; ...
The DNS record for DKIM: mail._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."
DKIM advantages over SPF: DKIM survives email forwarding (the signature travels with the message); it authenticates message content integrity not just server IP; it works with the header "From" domain. DKIM limitation: DKIM alone doesn't prevent display name spoofing or domain impersonation visible to users without DMARC enforcement.
DMARC builds on SPF and DKIM by adding policy enforcement and reporting. It requires that at least one of SPF or DKIM not only passes but also "aligns" — meaning the authenticated domain matches the visible "From" header domain that recipients see.
A DMARC record: _dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensic@example.com; pct=100"
DMARC policies: p=none (monitor only, no action); p=quarantine (send to spam if fails); p=reject (reject emails that fail). The rua tag specifies where aggregate reports are sent; ruf for forensic reports of individual failures.
Reporting: DMARC's reporting mechanism is unique — receiving mail servers send XML aggregate reports back to the sender, listing all mail they processed claiming to be from your domain, with pass/fail results for SPF and DKIM. This gives domain owners visibility into who is sending email on their behalf — essential for detecting spoofing and identifying unauthorized senders.
Your mail server sends an email. It signs the message with your DKIM private key and uses the Return-Path domain matching your SPF record.
Receiving server checks: is the sending IP in the SPF record for the envelope sender domain? Pass/Fail/SoftFail/Neutral result recorded.
Receiving server retrieves public key from DNS, verifies DKIM signature. Checks message content hasn't changed and signature is valid.
DMARC checks: does the SPF-authenticated domain align with the header From? Does the DKIM-signed domain align? If at least one passes alignment, DMARC passes.
Based on DMARC policy (none/quarantine/reject), receiving server decides whether to deliver, flag as spam, or reject the message.
Receiving server generates aggregate report data sent to the domain's rua address — showing total volume, pass/fail rates, and sending sources.
Use our DNS Lookup tool to inspect all three records for any domain:
v=spf1.selector._domainkey.example.com — you need to know the selector name (often "mail", "google", "smtp", or found in email headers)._dmarc.example.com. The full record shows policy, reporting addresses, and alignment mode.Our Email Checker tool also validates SPF and DMARC status for any domain automatically.